A recent decision on a motion before the Federal Court marks the progress of the Privacy Commissioner’s reference case on whether the Personal Information Protection and Electronic Documents Act (PIPEDA) includes a right to be forgotten. In an earlier report following the OPC’s consultation on digital reputation, the Privacy Commissioner had indicated that he was of the view that PIPEDA, in its unamended form, provided for a right to be forgotten that could be exercised against search engines.

The reference, launched on October 10, 2018, is linked to a complaint filed with the Office of the Privacy Commissioner (OPC) by an individual against Google. The Complainant is concerned that Google searches of his name produce links to news articles that he alleges “are outdated and inaccurate and disclose sensitive information such as his sexual orientation and a serious medical condition” (at para 6). The complainant’s view is that by providing prominent links to these articles, Google is breaching the PIPEDA. He is seeking to have these results de-indexed. This means that they would no longer appear in Google search results. De-indexing does not involve the removal of content from the source websites. Basically, the articles would still be out there, but they would not appear in Google search results. Unless similar orders were made against other search engines such as Bing, they content would be findable using those engines.

The Commissioner has referred two questions to the Federal Court. First, he seeks to know whether Google’s search engine activities constitute the “commercial activity” necessary to bring these activities within the scope of PIPEDA, which applies to the collection, use or disclosure of personal information in the course of commercial activity. The second question is whether Google’s search engine activities, even if commercial, fall within the exception to PIPEDA’s application where personal information is collected, used or disclosed “for journalistic, artistic or literary purposes and for no other purpose” (s. 4(2)(c)). Google and the Attorney General of Canada were given notice of the reference and are entitled to become parties to the reference. Google has challenged the scope of the reference. It seeks to add the question of whether, if PIPEDA does apply to the search engine’s activities, and if there is a deindexing order, such an order would violate s. 2(b) of the Canadian Charter of Rights and Freedoms. This motion to expand the scope of the reference had not yet been heard.

The CBC, along with a coalition of other Canadian media organizations brought motions seeking to be added as parties to the original reference. Their concern is that the Commissioner’s interpretation of the scope of PIPEDA as including a right to be forgotten is a violation of the freedom of expression guaranteed by s. 2(b) of the Charter. Their argument is based on the principle that the right of expression includes the right to receive information, and that measures taken to limit access to information in the news media thus breach the Charter. By bringing their motion, the media outlets sought to be added as parties, with the right to introduce evidence and make argument before the Court.

The motion was heard by Prothonotary Tabib, who rendered her decision on March 1. She began by noting that since the motion was being heard prior to any decision on Google’s motion to expand the scope of proceedings, party status would be considered only with respect to the original reference questions. She was critical of the motion on the basis that it proceeded “from the fundamental assumption that the Court’s determination of the jurisdictional questions in a way that confers jurisdiction on the OPC to investigate the underlying complaint will inevitably result in deindexing lawful news media content from Internet search results” (at para 17). She noted that in fact the reference questions were directed towards the issue of whether the Commissioner had jurisdiction in the matter. If the outcome of the reference was a finding that there was jurisdiction, the Commissioner would still have to investigate, would have to find the complaint well-founded, and would have to determine whether de-indexing was an appropriate remedy. The Commissioner can only make non-binding orders, so no Charter rights would be violated unless the matter proceeded to a recommendation to de-index with which Google voluntarily complied. If Google refused to comply the complainant or the Commissioner could bring the matter to Federal Court seeking a binding order, but the Court would hold a hearing de novo and might reach different conclusions. Basically, the prothonotary was of the view that the matter was a long way from breaching anyone’s Charter rights. She noted that “The media parties’ reliance on assumptions as to the ultimate result to form the cornerstone of their argument conflates all subsequent steps and determinations into the preliminary issue” (at para 18).

Prothonotary Tabib considered Rule 104(1)(b) of the Federal Courts Rules, which empowers the Court to order a person to be joined as a party. She focused on the issue of whether the presence of the media parties was necessary “for a full and effectual determination” of all of the issues in the reference. The media companies argued that their presence was necessary since the results of the reference would be binding on them. Prothonotary Tabib noted:

The media parties’ arguments thus essentially rest on the underlying assumption that what is truly at issue in this reference is the constitutionality of the Privacy Commissioner "“intended”" institution of a deindexing process in respect of lawful news content from Internet search results. However, as determined above, that is not what is truly at issue in this reference. What is at issue here is only whether Google is subject to or exempt from the application of Part 1 of PIPEDA in respect of how it collects, uses or discloses personal information in the operation of its search engine service when it presents search results in response to an individual’s name. (at para 36)

She observed that the only direct effect of the outcome of the reference would be the Commissioner’s decision to proceed with the investigation of the complaint against Google. She also noted that any freedom of expression impact that might ultimately flow from this matter would be shared by all internet content providers, as well as all those who used Google’s search engines. If the Charter interests of the media entitled them to be parties, then there was virtually no limit to who could be a party – which would be an absurd and unmanageable result. In her view it would be more appropriate for the media companies to seek intervenor status. However, she found that their motion did not address the issues they would need to establish for intervenor status. In brief, they failed to show how their contributions to the argument would be distinct from what Google would provide as party to the reference case. The motions were dismissed, with leave provided for the companies to reapply for leave to intervene once Google’s motion to vary the scope of the reference is decided.

The Office of the Privacy Commissioner of Canada has released its Draft Position on Online Reputation. It’s an important issue and one that is of great concern to many Canadians. In the Report, the OPC makes recommendations for legislative change and proposes other measures (education, for example) to better protect online reputation. However, the report has also generated considerable controversy for the position it has taken on how the Personal Information Protection and Electronic Documents Act currently applies in this context. In this post I will focus on the Commissioner’s expressed view that PIPEDA applies to search engine activities in a way that would allow Canadians to request the de-indexing of personal information from search engines, with the potential to complain to the Commissioner if these demands are not met.

PIPEDA applies to the collection, use and disclosure of personal information in the course of commercial activity. The Commissioner reasons, in this report, that search engines are engaged in commercial activity, even if search functions are free to consumers. An example is the placement of ads in search results. According to the Commissioner, because search engines can provide search results that contain (or lead to) personal information, these search engines are collecting, using and disclosing personal information in the course of commercial activity.

With all due respect, this view seems inconsistent with current case law. In 2010, the Federal Court in State Farm Mutual Automobile Insurance Co. v. Canada (Privacy Commissioner) ruled that an insurance company that collected personal information on behalf of an individual it was representing in a law suit was not collecting that information in the course of commercial activity. This was notwithstanding the fact that the insurance company was a commercial business. The Court was of the view that, at essence, the information was being collected on behalf of a private person (the defendant) so that he could defend a legal action (a private and non-commercial matter to which PIPEDA did not apply). Quite tellingly, at para 106, the court stated: “if the primary activity or conduct at hand, in this case the collection of evidence on a plaintiff by an individual defendant in order to mount a defence to a civil tort action, is not a commercial activity contemplated by PIPEDA, then that activity or conduct remains exempt from PIPEDA even if third parties are retained by an individual to carry out that activity or conduct on his or her behalf.”

The same reasoning applies to search engines. Yes, Google makes a lot of money, some of which comes from its search engine functions. However, the search engines are there for anyone to use, and the relevant activities, for the purposes of the application of PIPEDA, are those of the users. If a private individual carries out a Google search for his or her own purposes, that activity does not amount to the collection of personal information in the course of commercial activity.If a company does so for its commercial purposes, then that company – and not Google – will have to answer under PIPEDA for the collection, use or disclosure of that personal information. The view that Google is on the hook for all searches is not tenable. It is also problematic for the reasons set out by my colleague Michael Geist in his recent post.

I also note with some concern the way in which the “journalistic purposes” exception is treated in the Commissioner’s report. This exception is one of several designed to balance privacy with freedom of expression interests. In this context, the argument is that a search engine facilitates access to information, and is a tool used by anyone carrying out online research. This is true, and for the reasons set out above, PIPEDA does not apply unless that research is carried out in the course of commercial activities to which the statute would apply. Nevertheless, in discussing the exception, the Commissioner states:

Some have argued that search engines are nevertheless exempt from PIPEDA because they serve a journalistic or literary function. However, search engines do not distinguish between journalistic/literary material. They return content in search results regardless of whether it is journalistic or literary in nature. We are therefore not convinced that search engines are acting for “journalistic” or “literary” purposes, or at least not exclusively for such purposes as required by paragraph 4(2)(c).

What troubles me here is the statement that “search engines do not distinguish between journalistic and literary material”. They don’t need to. The nature of what is sought is not the issue. The issue is the purpose. If an individual uses Google in the course of non-commercial activity, PIPEDA does not apply. If a journalist uses Google for journalistic purposes, PIPEDA does not apply. The nature of the content that is searched is immaterial. The quote goes on to talk about whether search engines act for journalistic or literary purposes – that too is not the point. Search engines are tools. They are used by actors. It is the purposes of those actors that are material, and it is to those actors that PIPEDA will apply – if they are collecting, using or disclosing personal information in the course of commercial activity.